<HTML>
<HEAD>
<TITLE>Re: [BlueOnyx:05461] Re: Dealing with /admin URL 'hijacking</TITLE>
</HEAD>
<BODY>
<FONT FACE="Verdana, Helvetica, Arial"><SPAN STYLE='font-size:12.0px'>I agree on your first point that some obscurity of the login url is helpful, but having said that, my stance came from the viewpoint that the all CMS are generally less secure than the BlueOnyx authentication mechanism, especially if one keeps their passwords rather complex and change them frequently.<BR>
<BR>
Regards,<BR>
<BR>
Abdul Rashid<BR>
<BR>
<BR>
On 9/25/10 7:29 AM, "James Darbyshire" <jamesdarbyshire@gmail.com> wrote:<BR>
<BR>
</SPAN></FONT><BLOCKQUOTE><FONT FACE="Verdana, Helvetica, Arial"><SPAN STYLE='font-size:12.0px'>I disagree. Certainly it is not best practise for any admin functions to be accessible through a generic /admin url, but I would rather someone was trying to attack my CMS than my Server admin panel, where they have much higher security privileges than in my CMS.<BR>
<BR>
Worst case they graffiti my pages and I have to restore to a backup.<BR>
<BR>
If they get into my BO admin area they can royally screw with my server, and it possibly would not be as obvious/easy to detect.<BR>
<BR>
Regardless, it's no big deal.you just have to remember to change your BO settings when the config gets overwritten.<BR>
<BR>
Regards,<BR>
<BR>
James Darbyshire<BR>
<BR>
Sent from my Samsung Droid™<BR>
<BR>
</SPAN></FONT><BLOCKQUOTE><FONT FACE="Verdana, Helvetica, Arial"><SPAN STYLE='font-size:12.0px'>On 25/09/2010 11:54 PM, "Abdul Rashid Abdullah" <webmaster@muntada.com> wrote:<BR>
<BR>
Stephanie hit the nose on the target. I would prefer to modify the CMS<BR>
rather than BlueOnyx. When you migrate to a new system, you will deal with<BR>
the issue all over again. It is best to change it upfront.<BR>
<BR>
PLUS I am not sure who said something about BlueOnyx security and they<BR>
deleted it for that reason but I would say that it is FAR better to rename<BR>
the admin of a CMS as there is by far a higher likelihood of an exploit on<BR>
the CMS than on BlueOnyx coming into play. Zen Cart as an example EXPLICTLY<BR>
encourages all of the users to rename to something unique and specifically<BR>
warns you if I am remembering correctly if you don't do it. It is one of<BR>
their counter measures for not getting hacked.<BR>
<BR>
Regards,<BR>
<FONT COLOR="#888888"><BR>
Rashid<BR>
</FONT><BR>
<FONT COLOR="#500050"><BR>
<BR>
On 9/24/10 7:08 AM, "Stephanie Sullivan" <ses@aviaweb.com> wrote:<BR>
<BR>
> Jeff,<BR>
> <BR>
> I've yet to meet a...<BR>
</FONT></SPAN></FONT></BLOCKQUOTE><FONT FACE="Verdana, Helvetica, Arial"><SPAN STYLE='font-size:12.0px'><BR>
<HR ALIGN=CENTER SIZE="3" WIDTH="95%"></SPAN></FONT><FONT SIZE="2"><FONT FACE="Monaco, Courier New"><SPAN STYLE='font-size:10.0px'>_______________________________________________<BR>
Blueonyx mailing list<BR>
Blueonyx@blueonyx.it<BR>
<a href="http://www.blueonyx.it/mailman/listinfo/blueonyx">http://www.blueonyx.it/mailman/listinfo/blueonyx</a><BR>
</SPAN></FONT></FONT></BLOCKQUOTE><FONT SIZE="2"><FONT FACE="Monaco, Courier New"><SPAN STYLE='font-size:10.0px'><BR>
</SPAN></FONT></FONT>
</BODY>
</HTML>